CompTIA Security+ Practice Test (SY0-701)

While all listed documents play pivotal roles in a comprehensive security governance framework, Information Security Policies are crucial to defining the overall security strategy, essential for compliance with various regional, national, and global laws, and setting forth the rules and guidelines specific to the protection of the company's information assets. Updating the Information Security Policies will provide a foundation for the company's global security posture, ensuring that all other documents and practices align with these high-level policies and meet the regulatory requirements of each region in which the company operates.

The correct answer is Supply Chain. This scenario highlights the vulnerability that arises from dependence on a third-party service provider, which is a key component of the supply chain. An Insider Threat involves risks from within the organization, Zero-day refers to previously unknown vulnerabilities, and Misconfiguration pertains to incorrect setup of systems.

A snapshot is the most efficient method because it captures the entire state of a virtual machine at a specific point in time and is designed for rapid reversion. A full backup would work but restoring it would be significantly slower. Differential backups are also slower to restore as they require the last full backup as well. Replication to a warm site is a disaster recovery strategy for site-level failures, not for reverting a single server's configuration change.

A firewall filters or blocks network traffic according to predefined rules, helping to prevent unauthorized access over the network. It does not transform the actual data on the server. If an attacker bypasses the firewall-through stolen credentials, an insider threat, or physical access-the files remain readable unless they are encrypted. Encrypting the disk, volume, or files converts them into ciphertext that is unintelligible without the decryption key, preserving confidentiality even if the storage media is stolen or the system is compromised. Therefore, encryption-not the firewall-provides protection for data at rest.

A tap/monitor setup is preferred in scenarios where monitoring is essential, but it is crucial not to introduce latency or a single point of failure within the network traffic flow. An inline device would actively interact with traffic, potentially introducing latency, which is undesirable in strict throughput environments. Active devices are designed to intervene and could affect performance, whereas fail-open implies a state during failure, which is not relevant to the operational performance during normal conditions.

The zero trust security model works on the basis of “never trust, always verify.” Devices and users on the network are always required to be authenticated even if they were previously.

Recovery Time Objective (RTO) is the target time within which a business process must be restored after a disaster or disruption to avoid unacceptable consequences. In this scenario, the one-hour maximum acceptable downtime is the RTO.

Recovery Point Objective (RPO) is a different metric that defines the maximum acceptable amount of data loss, measured in time (e.g., "we can afford to lose up to 15 minutes of data").

Mean Time to Repair (MTTR) is a reliability metric representing the average time required to repair a failed component or device. Unlike RTO, which is a future-facing target for a specific process, MTTR is a historical average of repair times.

Mean Time to Detect (MTTD) is the average time it takes to discover that an incident has occurred.

Recovery Time Actual (RTA) is the real time it takes to complete a recovery, which is measured during a test or actual incident and compared against the RTO.

Patch availability is important because patches are released to fix security vulnerabilities and bugs in software, improving the security posture of the system. According to CISA, attackers may target vulnerabilities for months or even years after updates are available, so installing patches as soon as possible is critical. Without timely patch deployment, systems can remain susceptible to exploits and attacks.

Fingerprint scanning is the best solution in this scenario. It is a mature biometric technology that is not susceptible to spoofing from photographs or voice recordings, directly addressing the company's primary concern. While some facial recognition systems can be spoofed with high-quality images, advanced versions include liveness detection to prevent this. Voice recognition is particularly susceptible to being bypassed with recordings. A key fob is a possession-based factor ("something you have"), not a biometric factor ("something you are"), so it does not meet the requirement for a biometric method.

A detailed and current asset inventory is a foundational component of an effective disaster recovery plan. Without it, an organization cannot accurately prioritize which systems to restore first, understand dependencies between assets, or ensure that all necessary components are recovered. This leads to inefficient and delayed recovery efforts, potentially preventing the organization from meeting its Recovery Time Objectives (RTOs). The inventory is essential for knowing what needs to be restored to bring critical business functions back online.

Single sign-on (SSO) relies on a centralized identity provider. After the initial logon, the provider issues tokens that all integrated applications accept, so one compromised credential can unlock everything the user can reach. VPNs, network segmentation, and discretionary access control models do not inherently grant blanket access with one password.

Changes to production systems, even urgent security patches, must be documented and approved according to the organization's change management policy. This process, often initiated with a Change Request (CR) or Request for Change (RFC), ensures that changes are tested, scheduled, and have a backout plan, minimizing the risk of causing an operational outage. It is the proper first step before deploying any update.

A Key Risk Indicator (KRI) is a forward-looking metric tied to a specific risk. Tracking KRIs inside, or in direct association with, the risk register allows risk owners to spot deteriorating trends and take action before the threat reaches an unacceptable level. Items such as service-level agreements, memoranda of understanding, or general performance metrics do not fulfill this early-warning function within the risk register.

The central tenet of Zero Trust is 'never trust, always verify'. Unlike traditional security models that operate on the assumption that everything inside the network perimeter is safe, the Zero Trust model treats all traffic as untrusted, requiring continuous verification of each request, regardless of whether it originates from inside or outside the organization's network. The other options listed, while relevant to security, do not embody the foundational guideline of the Zero Trust model. 'Restricting user privileges' is a part of the principle of least privilege, 'encrypting data at rest' is a data security measure, and 'implementing implicit trust zones' goes against the Zero Trust model which doesn't use implicit trust.

Automated monitoring and alerting systems provide real-time detection of security events, which significantly reduce response times to potential incidents. By setting thresholds and parameters for normal network behavior, these systems can promptly identify and report suspicious activities, enabling quicker remediation. While all other options may contribute to effective security practices, automated alerting will most directly address the current delays and inconsistencies in incident detection and reporting, leading to improved security posture.

This statement is false because while secure tunneling protocols such as VPNs can provide a layer of security by encapsulating the data, encryption of the payload itself is necessary to ensure that the data remains confidential and protected from unauthorized access if the tunnel is compromised. Additionally, encrypting the data adds an extra layer of security in the form of end-to-end encryption, which is not solely dependent on the security of the tunneling protocol.

Longer passwords are generally more secure because they increase the number of possible combinations, making brute-force attacks more difficult and time-consuming. Although password complexity and lack of password reuse are important, increasing length has the most significant impact on a password's strength against cracking attempts.

Inspecting and logging web traffic allows the centralized proxy to monitor and record all incoming and outgoing web traffic. This inspection aids in identifying suspicious activities, ensuring adherence to organizational policies, and providing valuable information for audits or investigations. Restricting users from accessing the control panel does not primarily utilize the features of a centralized proxy. While tunneling through SSH can encrypt traffic, it would bypass the centralized proxy's filtering and monitoring capabilities. Configuring backups is necessary for data preservation but does not employ the centralized proxy's functions in traffic management.

Employing a biometric authentication system increases security by requiring personal physical attributes, making it significantly more resistant to systematic guessing and unauthorized entry compared to numerical access codes. Updating numerical access codes intermittently can temporarily prevent unauthorized access but does not inherently improve resistance against a focused attack. An audible alert after a set number of failed attempts might deter but not prevent an intruder who can still continue to attempt access. Video surveillance, although useful for monitoring and recording, does not in itself prevent unauthorized access.

Tokenization is the correct method for replacing sensitive data with a unique identifier that is not sensitive, known as a token, which has no extrinsic or exploitable meaning or value. The process allows businesses to work with the essential information without exposing sensitive data-enhancing security while minimizing the impact on systems that need to use the data. Encryption, in contrast, protects data by converting it into a coded format that can be decrypted only with a key, making it different from tokenization. Salting is used to enhance the security of a hashing process by adding a unique value to the end of the password before hashing occurs, thus providing no data obfuscation or replacement on its own. Anonymization is the process of removing personally identifiable information from data sets, so that the people whom the data describe remain anonymous, which is a broader concept than tokenization and does not necessarily use a token to replace sensitive data.